Malicious PDF — malware analysis report

Static analysis result for SHA-256 47cda202b759c46e…

MALICIOUS

PDF

47.6 KB Created: 2020-08-19 23:25:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7243932d0c5889c1476e41b2b1dee5b7 SHA-1: 4b62e4d7f02da99a81913765ec0f87fb9903da50 SHA-256: 47cda202b759c46e31cd291db1fa9c92826541b8829b2785d8e4e04c9ad82c14
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for SEO link farms and redirector abuse. One critical heuristic identified a link to a known malicious redirector infrastructure at 'https://ttraff.ru/pify?keyword=swedish+massage+consultation+form+template'. The document body, though heavily obfuscated, also contains this URL, suggesting the primary intent is to redirect the user to malicious content. The presence of many Shopify links, some confirmed benign and others unknown, indicates a broad attempt to disguise the malicious redirector within a larger link farm.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=swedish+massage+consultation+form+template
    • http://files.electrosmogalert.com/uploads/1/3/1/6/131637498/lalojewisunid.pdf
    • http://files.totalvein.net/uploads/1/3/0/7/130740521/sebajijapixotal_zukidegelidenog_zadolulefopaze.pdf
    • https://cdn.shopify.com/s/files/1/0439/4716/3806/files/unity_movement_script.pdf
    • https://cdn.shopify.com/s/files/1/0440/1093/0341/files/direito_penal_bittencourt.pdf
    • https://cdn.shopify.com/s/files/1/0437/1300/3674/files/sitosuginodatabupal.pdf
    • https://cdn.shopify.com/s/files/1/0433/9246/7109/files/vopugazefagofopijefegol.pdf
    • https://cdn.shopify.com/s/files/1/0430/4253/7629/files/pisutapugum.pdf
    • https://cdn.shopify.com/s/files/1/0428/1624/1831/files/76330399238.pdf
    • https://cdn.shopify.com/s/files/1/0435/5771/6119/files/boat_captain_s_log_book.pdf
    • https://cdn.shopify.com/s/files/1/0431/9094/3902/files/astell_kern_ak100_manual.pdf
    • https://cdn.shopify.com/s/files/1/0437/0884/2152/files/45154100416.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072b6.bin
766a0cc81aab2f4aab3a4f8c92441563a263bc05fcc1014562a5cab59e98bdd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72B6 5764 bytes
font_01_sfnt_off00008643.bin
816c4a6e9c666da064c51c33bb1eb13d8b48a2dc47eef39affdc005114f8efb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8643 13816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.